mirror of
https://github.com/servo/servo.git
synced 2025-06-08 08:33:26 +00:00
The expression `crossOriginIframe.contentWindow.location.href = "new href"` takes the following steps: (1) Get the setter for `href` by invoking `[[GetOwnProperty]]` on `crossOriginIframe.contentWindow. location`. (2) Call the setter, passing `crossOriginIframe. contentWindow` and `"new href"`. Since the target `Location` is cross origin, getting the setter succeeds only if the `CrossOriginWritable` extended attribute is present on the `href` attribute, and it's present. However, instead of `CrossOriginWritable`, `CrossOriginReadable` was checked mistakenly. Since `Location#href` has `CrossOriginWritable` but not `CrossOriginReadable`, this bug rendered `Location#href` inaccessible from a cross-origin document. |
||
---|---|---|
.. | ||
parser | ||
ply | ||
api.html.template | ||
apis.html.template | ||
Bindings.conf | ||
CodegenRust.py | ||
Configuration.py | ||
interface.html.template | ||
property.html.template | ||
run.py |